The Supreme Court unanimously ruled yesterday in Byrd v. United States that the driver of a rental car could have a reasonable expectation of privacy in the car even though the rental agreement did not authorize him to drive it. We’re pleased that that the Court refused to let a private contract dictate Fourth Amendment rights in this case, and we hope it’s instructive to other courts, particularly those confronted with the argument that terms of service undermine users’ expectation of privacy in third party email.

What Determines an Expectation of Privacy?

In Byrd, state troopers stopped Terrence Byrd while he was driving a rental car alone on a Pennsylvania interstate. Once the troopers realized he was not an authorized driver, they went ahead and searched the car, finding body armor and 49 bricks of heroin in the trunk. Byrd challenged the search on Fourth Amendment grounds, but both lower courts ruled that he did not have a Fourth Amendment interest in a car that he was not authorized by the rental company to drive. The Supreme Court disagreed.

The Court explained that as in any Fourth Amendment case, the starting point is to determine whether the individual has demonstrated a “reasonable expectation of privacy” in the place searched. Determining exactly what makes an expectation of privacy reasonable is notoriously difficult, but according to a 1978 case it “must have a source outside of the Fourth Amendment, either by reference to concepts of real or personal property law or to understandings that are recognized and permitted by society.” When it comes to places like houses and cars, the Court has developed a kind of sliding scale: owners and those in lawful possession (like tenants) “almost always” have a reasonable expectation of privacy, while short-term visitors do not. On the one hand, it’s not enough to simply happen to be somewhere in order to contest a search, but you don’t have to have a strict property interest in the place either, since overnight guests can contest a police search.

Byrd falls somewhere in the middle of this sliding scale. The Court compared him to the defendant in a 1960 case called Jones v. United States—not to be confused with the 2012 Jones case regarding GPS tracking—in which the defendant was staying alone in an apartment rented by his friend and was allowed to contest an illegal search by the police. In both cases, the defendants were the sole occupants of the place searched, so they had “dominion and control” and the “right to exclude” others from it. In light of this, Justice Kennedy wrote that there was “no reason” that an expectation of privacy should depend on “whether the car in question is rented or privately owned by someone other than the person in current possession of it.” As a result, the Court remanded for a determination of exactly whether Byrd’s possession of the car was lawful or whether he had a friend rent it as an illegal pretext.

Your Fourth Amendment Rights Shouldn’t Come with Terms and Conditions

Perhaps the more interesting question in the case, however, was whether the Budget Rent a Car agreement that Byrd’s friend signed before giving him the keys should have negated Byrd’s expectation of privacy in the car. That agreement provided in capital letters that permitting an unauthorized driver to drive the car was a violation of the rental contract that could void its coverage. The government argued that this provision automatically nullified Byrd’s expectation of privacy in the car.

Thankfully, the Supreme Court refused to go down this road. “As anyone who has rented a car knows, car-rental agreements are filled with long lists of restrictions,” including things like “driving the car on unpaved roads or driving while using a handheld cellphone. Few would contend that violating provisions like these has anything to do with a driver’s reasonable expectation of privacy in the rental car.” There might even be “innocuous” reasons to do something that voids the agreement, like allowing an unauthorized driver, such as when the official renter is too drunk to drive. At the end of the day, the Court wrote, rental agreements concern “risk allocation between private parties,” not someone’s expectation of privacy.

This is an encouraging result, especially because we’ve seen the government argue that private contracts—specifically email providers’ terms of service—should inform users’ expectations of privacy. In a case currently in front of the Tenth Circuit Court of Appeals, United States v. Ackerman, in which EFF recently filed an amicus brief, the district court held that when AOL terminated the defendant’s account pursuant to its TOS, it extinguished his expectation of privacy. In fact, the court wrote that the TOS itself “limited his expectation of privacy” because it “alerted Defendant that he was not to participate or engage in illegal activity.”

As we argued in Ackerman, terms of service should not determine expectations of privacy for the very reason that Justice Kennedy pointed to in Byrd—they are fundamentally contracts (of adhesion) between private parties, not the sort of thing that should dictate our privacy in relation to the government. As in rental car agreements, email providers’ TOS nearly always prohibit a wide range of behavior and allow the provider to unilaterally void the agreement. But just as with mail and telephone service, millions of Americans rely on the privacy of email and electronic communications even though they are facilitated by intermediaries, and the Fourth Amendment indisputably protects these communications.

While the Fourth Amendment’s application to email and the Internet cannot be mechanically compared to the law of traffic stops and apartment searches, we hope that other courts follow the Supreme Court’s firm rejection of the government’s terms-and-conditions-may-apply arguments in Byrd.

Related Updates

On Tuesday, the European Commission published two legislative proposals that could further cement an unfortunate trend towards privacy erosion in cross-border state investigati­ons. Building on a foundation first established by the recently enacted U.S. CLOUD Act, these proposals compel tech companies and service providers to ignore critical privacy...

The Egyptian government is currently debatinga bill which would compel all ride-sharing companies to store any Egyptian user data within Egypt. It would also create a system that would let the authorities have real-time access to their passenger and trip information. If passed, companies such as...

After the shocking news of the massive Equifax data breach, which has now ballooned to jeopardize the privacy of nearly 148 million people, many Americans are rightfully scared and struggling to figure out how to protect themselves from the misuse of their personal information. To protect against credit fraud, many...

Mark Zuckerberg, Facebook’s founder and CEO, thinks people want targeted advertising. The “overwhelming feedback,” he said multipletimes during his congressional testimony, was that people want to see “good and relevant” ads. Why then are so many Facebook users, including leaders of state in the U.S. Senate...

A decision by the Minnesota Supreme Court on Wednesday will help the public learn more about how law enforcement use of privacy invasive biometric technology. The decision in Webster v. Hennepin County is mostly good news for the requester in the case, who sought the public records as part...

We filed an amicus brief in a federal appellate case called United States v. Ackerman Friday, arguing something most of us already thought was a given—that the Fourth Amendment protects the contents of your emails from warrantless government searches. Email and other electronic communications can contain highly personal, intimate...

After grilling Mark Zuckerberg for ten hours this past week, the big question facing Congress is, “What’s next?” The wide-ranging hearings covered everything from “fake news” to election integrity to the Cambridge Analytica scandal that spurred the hearings in the first place. Zuckerberg’s testimony did not give us much...

In ten total hours of testimony in front of the Senate and the House this week, Mark Zuckerberg was able to produce only one seemingly straightforward, privacy-protective answer. When Sen. Gary Peters asked Zuckerberg if Facebook listens to users through their cell phone microphones in order to collect information...

During Congressional hearings about Facebook’s data practices in the wake of the Cambridge Analytica fiasco, Mark Zuckerberg drew an important distinction between what we expect from our Internet service providers (ISPs, such as Comcast or Verizon) as opposed to platforms like Facebook that operate over the Internet. Put simply, an...

If you watched even a bit of Mark Zuckerberg’s ten hours of congressional testimony over the past two days, then you probably heard him proudly explain how users have “complete control” via “inline” privacy controls over everything they share on the platform. Zuckerberg’s language here misses the critical distinction between...